e3-hacking February 2005

e3-hacking@earth.li

4 participants
6 discussions

E3 Software Unready When E3 Launched.
by Ralph Corderoy 22 Feb '05

22 Feb '05

Hi, People are probably getting fed up with me posting on this list but I thought some of Sir Alan Sugar comments in Amstrad's interim trading statement were worthy of another post. http://inputplus.co.uk/ralph/emailer/extnews.html Amstrad or Emailers in the news Links to selected items of news regarding Amstrad or Emailers that may be of interest. Oldest first. [snip] * 2005-02-17 Amstrad [9]press release announces an interim statement for the six months ending 2004-12-31. Initial E3 sales have been low, but it was launched lacking full functionality because the software wasn't ready. Once new software is available various initiatives are planned to stimulate sales. In the short term, the software will allow pictures to be retrieved and displayed from digital cameras, and sent by email. Also planned, is the ability to run the unit on an ADSL line. A PDF of the full preliminary announcement is available from the press release. 9. http://www.amstrad.com/news_latest.html Cheers, Ralph.

1 0

Re: E2 PBL bios dump.
by en4rab 21 Feb '05

21 Feb '05

I have sent otaku a copy of the bios dump i made from my E2 emailer. I also had an idea for recovery of the bios of the E3, has anyone yet worked out if the Jtag port of the CPU in the E3 is taken to a usable header on the e3's board. According to the datasheet for the e3's cpu the jtag pins are at locations U15, U16, U17, T14 and R13 (the jtag signals are called (nTrst, TDO, TDI, TMS and TCK off hand i cant rember which pin is which) If these pins are routed to a suitable set of test points it should be relatively easy (if time consuming) to dump the bios of the E3 using an inexpensive (�10ish) wiggler type jtag interface. This site has details of how to build a cheap wiggler compatible buffered jtag lead, http://jtag-arm9.sourceforge.net/ , however there are several places selling these interface for around a tenner (although these dont include the transistor for control of the nTrst line) since jtag leads have just become a popular way to read data off some other UK equipment. Dumping of the bootloader could then be done using either macraigors , http://www.macraigor.com/ , flashprog (the demo will read but not write the flash) or the long winded method using ocd commander and a macro to read each byte then converting the log of this macro to a binary file (which was how I dumped the E2 bios as i hadnt sussed flashprog :) If the E3 behaves like the E2 did it will have its WDT enabled and locked so about 4 or 5 seconds after you halt the CPU the WDT will time out and reset the box, this resulted in the memory controller being in its boot up state with the bios (on chip select 0) being mapped throught the whole of memory, reading past the end of the bios chip just looped back to the beginning of the chip. Because the WDT was enabled I was unable to get a dump of the ram from a running box so i couldnt recover the uncompressed firmware image from ram. I am interested in getting an E3 to play with but unfortunately time and money are not on my side at the moment, but if i do i will look at dumping the E3 bios too (and ram if WDT is not enabled) Just a word of warning, dont use a jtag interface that doesnt have a 74hc244 or ac244 chip as i dont think arm cores are 5v tolerant so the simple resistor based jtag leads may well kill the CPU. I think the jtag interface from tailor-madecircuits, http://www.tailor-madecircuits.com/jtag_interface.htm , should work for dumping the bios but it doesnt have the nTrst circuitry, but I think it will work, but be warned TMC have had a run on these so there is a bit of a delay on them. Obviously all of this will only be of use if the jtag signals have been routed to somewhere usefull on the E3's board. en4rab ===== -- | .-. en4rab(a)yahoo.com | / \ .-. | / \ / \ .-. .-. _ _ +--/-------\-----/-----\-----/---\---/---\---/-\-/-\/\/--- | / \ / \ / '-' '-' |/ '-' '-' -END OF TRANSMISSION- __________________________________ Do you Yahoo!? Take Yahoo! Mail with you! Get it on your mobile phone. http://mobile.yahoo.com/maildemo

2 2

Re: E2 Watchdog timer
by en4rab 21 Feb '05

21 Feb '05

Yes possibly a macro could be writen for macraigors ocd debug to periodically write 0xa5a5 to the watchdog counter reset register inbetween commands to read other bits of memory but it would be a tedious way to do things.

2 1

E2 PBL Dump, anyone ?
by Otaku 10 Feb '05

10 Feb '05

Anyone ( *ahem* Ralph ) happen to have a dump of the E2 Atmel flash ? I'm hoping there are similarities in the way the main image is treated , and this could help me with the E3 I'm working on.. Cheers

2 1

Jonathan Obtaining E3 Boot Output.
by Ralph Corderoy 08 Feb '05

08 Feb '05

Hi, http://www.earth.li/~noodles/files/delta.boot is interesting. How was it obtained? By the EXP connector on the back being the SoC's UART0? Any wiring details I can put up on http://inputplus.co.uk/ralph/emailer/ for others to follow? Thanks, Ralph.

2 1

E2's Boot-loader UART0 Protocol Semi-Available.
by Ralph Corderoy 02 Feb '05

02 Feb '05

Hi, I've added a little information the the serial protocol the E2's PBL bootloader talks over UART0. http://inputplus.co.uk/ralph/emailer/ (Sorry for the `drip, drip' of emails rather than one all-encompassing one, but I don't want to hold releasing information if I suffer from lack of time.) A later version of PBL is used in the E3 according to Jonathan's dmesg output. Cheers, Ralph.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

e3-hacking February 2005